VulnSocial

CVE-2026-41448Disclosure

LOWCVSS 9.2 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

AdGuard Home, when started with the --glinet flag, contains an authentication bypass vulnerability that allows unauthenticated attackers to gain full admin access by supplying a path traversal sequence in the Admin-Token cookie, exploiting unsanitized string concatenation in the token file path construction within the authglinet middleware. Attackers can craft a request with a traversal payload in the Admin-Token header to redirect file reads to arbitrary paths.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-06-10: 1Patch / Workaround · 2026-06-10: 1Technical Details · 2026-06-10: 106-10
Signal classification1 categories
Disclosure
1100.0%
Referenced assets3 URLs
Full discourse1 post
  • FOFA@fofabot
    Disclosure

    ⚠️⚠️ CVE-2026-41448 (CVSS 9.4): AdGuard Home instances started with --glinet may allow unauthenticated admin takeover via Admin-Token path traversal (patch: v0.107.77+). 🔗FOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJBREdVQVJELUhvbWUi 🎯122K+ Results are found on http://en.fofa.info in the past year. FOFA Query: app="ADGUARD-Home" 🔖Refer: https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.107.77 #OSINT #FOFA #CyberSecurity #Vulnerability

    Post summary

    AdGuard Home is vulnerable to a high‑severity path traversal that allows unauthenticated admin takeover; a patch (v0.107.77+) is available, and FOFA shows many exposed instances, but no active exploitation is reported.

    0202882.7K
    14.5K followersView on X

Explore more

Back to dashboard